You make some good points, but her contributions to the US's surveillance program are barely more than a footnote on the campaign page. Most are about past economic or geopolitical misdeeds. I think reading the page in toto makes it pretty clear that the authors object to her hiring mainly on the basis of her perceived character flaws.
I was still fairly outraged over the Eich lynching when I wrote all these posts. I still don't think it's a great precedent to set, boycotting a company over appointing someone to a mostly ceremonial position. (Something that I still think is terribly gutless to do anonymously, no matter who you're targeting.) But I do actually buy the privacy argument. And I have to admit, it's really disconcerting to be put in the position of defending the actions of Condoleezza Rice (or any other prominent Bush 43 official).
You're also mischaracterizing the nature of the boycott: the target whose behavior it's trying to change isn't Rice, it's Dropbox. And the goal is their policies around privacy, surveillance, and government cooperation. Rice is a seed that these issues can crystallize around, but anything that happens to her personally is sort of collateral damage.
At least that describes some principled support for this campaign. There may also be some that want her to personally suffer and don't care about Dropbox's policies.